The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell script (xy-sync.sh) located in a relative sibling directory (../xy-sync/scripts/) for version checking during every invocation.
[DATA_EXFILTRATION]: The skill instructs the agent to save user queries and dialogue snippets to a local directory (~/.xy/feedback/) when users report issues. While intended for local debugging, it creates a persistent record of conversation data.
[EXTERNAL_DOWNLOADS]: The atoms-search.py script performs network requests to api.xyskill.xyz to retrieve knowledge base entries ('atoms') for use in the agent's logic.
[INDIRECT_PROMPT_INJECTION]: As a routing skill, it ingests untrusted user input and interpolates it into calls for downstream skills (e.g., Skill: xy-close) without explicit boundary markers or sanitization, potentially allowing malicious user instructions to influence subsequent skill executions.
Ingestion points: User input provided to the /xy command and conclusions from preceding xy-* skills.
Boundary markers: None present in the instructions for tool calls.
Capability inventory: Shell command execution (bash), local file writing (~/.xy/feedback/), and network operations (urllib.request).
Sanitization: No evidence of input validation or escaping before interpolation into tool parameters.

xy